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HaL's  DCE  Cell  Manager:  An  Evaluation 


Executive  Summary 

Managing  and  administering  an  Open  Software  Foundation  (OSF)  Distributed 
Computing  Environment  (DCE)  Cell  can  be  a  dificult  and  time  consuming  task.  HaL's 
DCE  Cell  Manager  is  a  product  designed  to  make  the  administration  task  easier.  This 
report  describes  an  evaluation  of  the  Cell  Manager. 

The  Cell  Manager  is  evaluated  and  found  to  be  a  useful  tool  for  easing  the  burden  of 
DCE  cell  administration.  Several  problems  and  potential  problems  are  identified. 
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1.  Introduction 


The  Open  Software  Foundation's  Distributed  Computing  Environment  (DCE)  was 
conceived  to  provide  solutions  to  many  of  the  problems  encountered  in  implementing 
distributed  systems,  including: 

•  Scalability 

•  Interoperability 

•  Security 

•  Reliability 

•  Manageability 

Although  the  early  releases  of  DCE  address  the  first  four  items  reasonably  well,  the 
last,  namely  Manageability  was  not  addressed  to  the  same  degree.  DCE  release  1.0.2 
includes  several  comand  line  utility  programs  (eg:  rgy_edit,  cdscp,  rpccp,  and  acl_edit) 
but  these  have  a  poor  user  interface.  Some  of  the  vendors  of  DCE  shipped  extensions 
to  these  tools  with  graphical  user  interfaces.  Other  vendors  extended  their  system 
management  programs  to  include  some  DCE  features,  and  yet  others  produced 
products  entirely  dedicated  to  the  management  of  a  DCE  cell.  Refer  to  [1]  for 
background  understanding  of  DCE. 

DSTO  Task  ADF  94/151  (Distributed  Systems  Technology)  includes  research  into 
Distributed  Systems  and  Distributed  Systems  Management,  and  development  of 
prototypes  [2,3]  that  demonstrate  the  potential  of  the  Open  Software  Foundation's 
(OSF)  Distributed  Computing  Environment  (DCE)  technology  for  meeting  C3I  system 
requirements1. 

This  report  describes  an  evaluation  of  the  Cell  Manager,  a  software  product  from  HaL 
Software,  which  simplifies  the  tasks  of  managing  and  administrating  a  DCE  cell.  The 
evaluation  of  the  HaL  Cell  Manager  served  three  objectives: 

•  To  gain  a  better  understanding  of  the  current  state  of  DCE  cell  management. 

•  To  become  sufficiently  familiar  with  the  Cell  Manager  to  be  able  to  comment  on 
the  quality  and  usefulness  of  the  product. 

•  To  communicate  the  findings  to  relevant  areas  in  the  ADF  and  DSTO. 


NOTE1:  The  work  reported  here  was  undertaken  as  part  of  DSTO's  participation 
in  the  Cooperative  Research  Centre  for  Distributed  Systems  Technology. 
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1.1  What  Is  DCE  Cell  Management  ? 


According  to  Langsford  and  Moffett[2]  there  are  three  categories  of  Information 
Technology  (IT)  management  that  need  to  be  considered: 

•  Management  of  hardware  and  software,  including  system  software  and 
applications  software 

•  Management  of  system  support  services,  such  as  naming,  addressing,  controlling 
system  access,  accounting,  security  and  audit 

•  Management  of  user  support  services,  such  as  those  for  troubleshooting  and 
training 

DCE  is  organised  into  administrative  domains  called  cells.  A  DCE  cell  consists  of  a 
security  service,  a  Cell  Directory  Service  (CDS),  a  Distributed  Time  Service  (DTS),  and 
possibly  a  Distributed  File  Service  (DFS).  Although  these  services  may  be  distributed 
across  computers  in  a  cell,  they  appear  to  the  user  as  a  centralised  set  of  services.  In 
addition  to  the  DCE  services,  a  DCE  application  relies  upon  communication  services, 
operating  system  services  and  possibly  other  services  such  as  the  availability  of 
Database  Management  Systems. 

The  manager  of  a  DCE  application  must  ultimately  be  able  to  configure,  monitor, 
troubleshoot  and  maintain  all  of  the  software  components  upon  which  the  application 
relies. 

This  report  is  concerned  with  the  day  to  day  management  of  a  DCE  cell,  involving  all 
three  of  the  above  categories. 


1.2  The  Importance  of  Distributed  System  Management 


Managers  of  Distributed  Systems  are  demanding  better  tools  to  help  them  do  their 
jobs.  In  [3],  Phillip  Gill  states: 

'Vendors  themselves  are  well  aware  that  they  have  a  ways  to  go  before  they  deliver 
integrated  products  for  distributed-computing  environments  that  live  up  to  the 
expectations  of  users,  who  want  to  duplicate  the  coordination  they  can  exercise  in  the 
legacy  mainframe  data  centre,  but  in  the  more  loosely  structured  networked 
environment'. 
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As  more  and  more  large  corporations  move  their  information  systems  from 
mainframe  environments  to  client/server  or  distributed  environments,  the  need  for 
system  management  becomes  vital.  In  a  distributed  system,  the  number  of  computers 
and  different  types  of  computers  is  larger,  and  therefore  more  difficult  to  maintain.  In 
a  DCE  system,  the  task  of  the  management  system  is  easier  because  DCE  hides  some 
of  the  complexities  of  multiple  platforms,  and  provides  a  consistent  naming  and 
security  system.  The  ongoing  management  of  the  system,  however,  is  no  less 
important. 


2.  Overview  Of  HaL  Cell  Manager 


The  HaL  Cell  Manager  was  designed  with  the  single  intent  of  managing  a  DCE  cell 
and  DCE  applications.  Cell  Manager  is  available  on  a  variety  of  platforms  including 
HP,  DEC  Alpha  (OSF/2),  IBM  AIX,  and  Solaris.  There  are  two  main  components  of 
the  cell  manager,  agent  software  (which  must  be  installed  on  every  computer  in  the 
cell)  and  the  management  software  which  has  a  number  of  components.  The 
following  diagram  shows  the  architecture  of  the  cell  manager  software. 


Figure  1:  Architecture  of  the  Cell  Manager  software 
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For  the  evaluation,  the  cell  manager  Graphical  User  Interface  (GUI)  software  was  run 
on  a  HP  computer,  with  Motif  as  the  GUI  platform.  From  the  user's  point  of  view,  the 
GUI  depicted  in  Figure  1  is  further  divided  into  four  components:  the  Namespace 
Manager,  the  Configuration  Manager,  Security  Manager  and  the  DCE  Cell  Manager 
Launcher.  The  following  sections  give  an  outline  of  each  of  these  four  components. 

2.1  DCE  Cell  Manager  Launcher 


The  DCE  Cell  Manager  Launcher  is  a  small  window  with  a  button  to  launch  the  other 
components  of  the  Cell  Manager.  A  help  button  is  also  available  on  this  window. 

2.2  Namespace  Manager 

When  started,  the  Namespace  Manager  displays  a  graphical  tree  representation  of  the 
CDS  database.  There  are  icons  representing  the  different  types  of  CDS  entries.  The 
user  can  then  click  on  any  icon  and  expand  or  contract  parts  of  the  tree.  From  the 
menu,  a  search  can  be  performed  to  find  a  particular  entry.  Entries  can  be  added, 
deleted  and  properties  modified  by  selecting  an  entry  and  either  right  clicking  the 
mouse  or  selecting  the  appropriate  menu  item.  Server  entries  can  be  "pinged"  to  see  if 
the  server  is  currently  responding.  The  Namespace  Manager  also  provides  a 
convenient  way  to  edit  the  Access  Control  Lists  (ACLs)  associated  with  CDS  entries. 
CDS  Clearinghouses  and  Replicas  can  be  created,  deleted  and  changed.  The  CDS 
namespace  can  also  be  backed  up  to  a  specified  directory  using  the  Namespace 
Manager. 

2.3  Configuration  Manager 

The  Configuration  Manager  is  used  to  monitor  and  maintain  the  DCE  cell 
configuration.  The  display  has  two  windows.  The  first  window  shows  a  list  of  the 
computers  in  the  cell  and  associated  information  in  a  table.  Attributes  selected  from 
the  following  list  are  displayed,  depending  on  the  display  configuration.  The  user  can 
enable  or  disable  display  of  any  of  the  items  to  make  the  display  more  meaningful  and 
manageable.  Available  attributes  are: 

•  Architecture 

•  Average  Load 

•  Comments 

•  Host  Alias 
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IP  Address 


•  OS  Name 

•  OS  Release 

•  OS  Version 

•  Processor 

•  Up  Time 

The  second  window  shows  information  depending  on  which  view  is  selected  in  the 
first  window,  from  the  following  possibilities: 

•  DCE  status 

•  DTS  status 

•  RPC  Mapping 

•  Cached  Clearinghouse  status 

•  CDS  Clerk  status 

•  CDS  server  status 

•  Ping 

This  information  is  only  displayed  for  the  hosts(computers)  which  are  selected  in  the 
first  window.  A  whole  range  of  actions  can  be  carried  out  upon  the  hosts  in  the  cell 
such  as  monitoring,  pinging,  filtering  the  display,  and  changing  the  DCE 
configuration  of  a  host  from  the  Configuration  Manager.  These  will  be  discussed 
further  in  Section  4. 

2.4  Security  Manager 

The  Security  Manager  display  is  a  two  window  display  similar  to  that  of  the 
Configuration  Manager.  The  Security  Manager  is  used  primarily  to  view  and 
manipulate  information  in  the  DCE  cell  security  registry.  The  display  can  be  filtered 
and  searches  performed  which  helps  significantly  when  the  registry  is  large.  The  right 
window  can  be  used  to  display  attributes  associated  with  the  items  in  the  left  window. 
For  example,  if  the  left  window  is  displaying  groups,  the  right  window  could  display 
all  of  the  members  of  a  selected  group,  and  some  associated  attributes  for  each  of  those 
members.  All  of  the  entry  types  can  be  manipulated  (added,  deleted,  attributes 


changed).  For  example,  a  principals  full  name  attribute  can  easily  be  changed  using 
the  GUI  based  tool.  The  left  window  can  be  used  to  display  one  of  the  following: 

•  Organisations 

•  Groups 

•  Principals 


There  is  also  a  tree-graph  display  of  the  security  registry  which  can  help  to  visualise 
the  registry  contents.  From  the  tree-graph  display,  ACL's  for  the  various  types  of 
registry  entries  can  be  modified. 

From  the  main  Security  Manager  menu,  the  registry  can  be  backed  up.  This  process 
simply  puts  the  master  database  into  maintenance  state  while  the  user  copies  the 
various  files  to  a  backup  directory.  The  master  database  can  then  be  returned  to 
operational  state. 


6 


3.  Methodology 


The  evaluation  of  the  HaL  Cell  Manager  took  place  over  a  period  of  30  days,  using  a 
free  evaluation  license  from  HaL,  using  version  1.1c.  Version  1.5  of  Cell  Manager  was 
due  to  be  released  shortly  after  the  test  was  completed.  The  main  GUI  tool  and  the 
Coll_Svr  software  were  installed  on  a  HP  computer  and  Host_Svr  (agent)  software 
was  installed  on  each  of  the  DEC  Alpha,  Sun  Solaris  and  OS/2  platforms. 

The  software  was  exercised  by  performing  the  duties  which  are  commonly  required  to 
maintain  the  cell,  such  as  adding  and  deleting  principals,  directories  and  server 
entries.  Also,  the  features  specific  to  Cell  Manager  were  tested,  such  as  monitoring, 
logging  and  backing  up.  Refer  to  Table  1.  for  a  complete  list  of  functions  evaluated. 


Cell  Manager  Functions  /  Areas  Evaluated 

Overall 

Useability 

Reliability 

CDS 

General  Display  /  Useability 

Display  and  Edit  Directories 

Display  and  Edit  Servers 

Display  and  Edit  Groups /Profiles 

CDS  Backup  support 

SECURITY 

General  Display  /  Useability 

Display  and  Edit  principals 

Display  and  Edit  accounts 

Display  and  Edit  Organisations 

Display  and  Edit  groups 

Display,  Edit  and  Verify  ACLs 

Security  Backup  support 

Application  /  Cell  Configuration  Management 

Test  /  ping  hosts 

Warning  upon  failure 

Monitoring  and  Logging  DCE  status 

Synchronising  time 

Table  1:  Cell  Manager  Functions  /  Areas  Evaluated 

The  purpose  of  this  approach  was  to  gain  a  level  of  confidence  that  Cell  Manager 
performed  as  expected  both  in  terms  of  function  and  response  times.  The  Cell 
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Manager  was  left  in  the  logging  state  for  a  considerable  period  of  time  to  evaluate  the 
stability  of  the  product. 


3.1  Stress  Test 


Using  the  password  import  function  of  the  Security  Manager,  a  large  number  (1000)  of 
principals  were  added  to  the  security  registry,  displayed  and  deleted,  to  test  the 
scalability  of  the  product.  This  function  simply  calls  the  passwd  import  command  of 
the  rgy_edit  command  line  utility.  A  passwd  and  group  file  were  created  specifically 
for  this  test.  The  names  of  the  principals  were  all  the  same,  with  the  exception  that  a 
number  was  appended  to  the  end.  The  numbers  were  in  ascending  order  in  the 
passwd  file.  A  similar  naming  scheme  was  used  for  each  of  the  50  groups  in  the 
group  file,  with  20  principals  per  group  making  up  the  1000.  In  addition,  the  user  IDs 
(uids)  and  group  IDs  (gids)  were  assigned  so  that  no  conflicts  would  occur  with  the 
existing  principals  and  groups  in  the  cell  registry. 

The  evaluation  was  conducted  by  a  person  familiar  with  DCE  and  DCE  cell 
administration  using  the  command  line  tools.  It  is  expected  that  in  most  cases  the 
users  of  the  Cell  Manager  would  be  cell  administrators  and  they  would  be  familiar 
with  DCE  cell  administration  concepts. 


4.  Results 


4.1  The  Installation  Process 

There  were  several  minor  problems  in  the  installation  of  the  Cell  Manager.  First,  after 
the  software  was  delivered,  it  was  realised  that  software  license  codes  were  required  in 
addition.  When  the  license  codes  were  obtained,  they  were  not  accepted  by  the  license 
server.  A  second  set  of  codes  were  obtained  and  finally  the  Cell  Manager  could  be 
started. 

The  second  problem  was  with  the  agent  software  that  was  to  run  on  the  OS/2 
computer.  The  first  two  versions  that  were  sent  had  a  severe  error  in  the  installation 
program  that  prevented  the  OS/2  agent  software  from  being  installed.  After  a  third 
version  of  the  program  was  obtained,  the  OS/2  computer  could  also  be  managed  from 
the  Cell  Manager.  This  mainly  affected  use  of  the  Configuration  Manager. 
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4.2  Useability 


The  Cell  Manager  represents  a  great  increase  in  useability  compared  to  the  command 
line  utilities  provided  with  DCE  1.0.3.  The  operator  can  visualise  the  namespace  and 
the  security  registry.  Monitoring  can  be  left  on  and  at  a  glance,  an  operator  can  see  if  a 
major  problem  has  developed  in  the  cell.  The  ability  to  easily  edit  CDS  and  Security 
information,  and  remotely  configure  DCE  are  very  useful  features  of  the  Cell  Manager. 

There  are  a  number  of  areas  of  the  Cell  Manager  user  interface  that  could  be 
improved.  For  example,  the  actions  required  to  modify  the  full-name  of  a  principal 
were  not  immediately  obvious  from  the  Security  Manager  display.  In  several  cases, 
such  as  adding  many  users  to  a  single  group,  it  is  not  possible  to  select  the  group  from 
a  list,  the  information  must  be  keyed  in  (or  copied  and  pasted)  each  time.  The  actions 
required  to  view  and  modify  RPC  mappings  are  not  intuitive.  The  author  expected  to 
find  RPC  mappings  by  clicking  on,  or  selecting  a  menu  item  while  having  a  CDS  entry 
selected,  in  the  Namespace  Manager.  It  turned  out  that  RPC  mappings  are  accessible 
only  from  within  the  Configuration  Manager.  This  points  out  another  weakness,  that 
the  components  of  the  Cell  Manager  could  be  better  integrated.  The  tool  lacks  some 
GUI  features  which  would  be  expected  in  a  mature  product.  For  example,  when 
attempting  to  import  principals  and  groups  from  group  and  passwd  files,  the  user 
must  enter  the  path  to  these  files.  There  is  no  facility  to  browse  the  directory  structure 
using  a  "find  file"  dialogue  box. 

In  some  situations,  the  Cell  Manager  just  reports  the  last  DCE  error  that  was  returned 
to  it  while  executing  some  DCE  commands.  This  can  be  misleading  but  in  one  case  at 
least,  the  help  system  provided  some  hints.  The  operator  is  not  left  stranded,  since  he 
or  she  can  turn  on  command  logging,  re-try  the  operation  and  then  browse  through 
the  command  log  to  see  where  the  problem  started. 

The  help  system  is  quite  extensive  and  useful.  For  the  most  part  it  was  unnecessary, 
since  the  design  and  layout  of  most  of  the  buttons,  displays  and  menus  is  self- 
explanatory. 

When  the  user's  security  ticket  expires,  the  user  is  left  with  no  option  but  shutting 
down  the  entire  cell  manager  and  starting  it  again.  It  would  be  better  if  the  user  was 
given  a  choice  of  being  able  to  either: 

•  Select  a  menu  option,  and  re-enter  their  username  /  password  pair. 

•  Store  their  password  in  a  DCE  keyfile  and  give  the  Cell  Manager  access  to  that  file 
so  that  it  could  automatically  refresh  the  user's  credentials. 
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4.3  Performance  and  Response  Times 


4.3.1  Namespace  Manager 

The  Namespace  Manager  takes  a  significant  time  to  load  (approx  30  secs  in  the  case  of 
this  test).  It  reads  a  large  amount  of  information  from  the  CDS  database.  This  did  not 
stop  the  tool  from  being  used  effectively,  but  the  test  cell  is  a  small  cell  with  relatively 
few  entries  in  the  CDS.  It  seems  likely  that  in  a  large,  busy  cell  the  performance  of  the 
Namespace  Manager  would  be  poor. 

The  ability  to  display  CDS  directories.  Server  Entries,  simple  entries,  groups  and 
profiles  is  very  good.  The  ability  to  add,  delete  and  modify  these  types  of  CDS  objects 
is  as  expected.  Further,  no  problems  were  experienced  in  modifying  ACLs  associated 
with  CDS  entries. 

The  ability  of  the  Namespace  Manager  to  "ping"  selected  servers'  entries  was  tested. 
Although  this  function  works,  the  dialogue  box  that  displays  the  results  can  be 
confusing.  In  one  case  a  server  entry  had  two  bindings  exported  to  it.  One  of  these 
bindings  was  for  a  server  which  was  no  longer  running.  The  first  dialogue  to  be 
displayed  said  that  an  error  had  occurred,  even  though  the  user  knew  that  a  valid 
server  was  running. 

The  CDS  clearinghouse  and  replica  functions  of  the  Namespace  Manager  were  not 
tested.  The  backup  capability  was  tested  and  found  to  work. 

4.3.2  Security  Manager 

The  performance  of  the  Security  Manager  was  generally  good.  The  time  to  load  the 
Security  Manager  was  approximately  30  seconds.  As  with  the  Namespace  Manager 
this  did  not  hinder  it's  use  but  implies  that  the  Security  Manager  would  perform 
poorly  in  a  large  cell.  The  Security  Manager  performed  well  at  the  day  to  day  tasks 
such  as  displaying,  adding,  deleting  and  modifying  DCE  registry  objects  (principals, 
accounts,  organisations  and  groups).  The  user  actions  required  to  perform  the  various 
actions  on  these  registry  objects  are  more  intuitive  than  the  rgy_edit  command  line 
utility. 

The  ability  to  modify  ACLs  associated  with  objects  in  the  security  registry  is 
convenient.  This  facility  was  tested  and  found  to  work  correctly.  The  backup 
capability  of  the  Security  Manager  was  also  found  to  function  correctly.  However,  in 
contrast  to  backing  up  the  CDS,  when  the  security  registry  is  backed  up,  the 
administrator  must  manually  copy  the  appropriate  files  to  a  backup  location.  This  is 
inconsistent  with  the  Namespace  Manager. 
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In  order  to  stress  test  the  Security  Manager,  one  thousand  principals(users)  were 
added  to  the  cell  using  the  import  function.  The  import  was  successful  and  took 
approximately  five  minutes.  Display  of  the  registry  information  was  not  slowed 
appreciably  by  the  increased  number  of  principals.  The  filtering  available  made  it 
possible  to  filter  out  all  of  the  1000  principals  (since  they  were  all  members  of  the  test 
organisation)  and  look  at  the  other  principals.  Deleting  the  principals  was  a  simple 
action,  but  took  one  hour  to  complete.  The  groups  associated  with  the  1000  principals 
were  then  also  deleted  from  the  registry. 

For  comparison  with  Security  Manager,  a  shell  script  was  created  that  deleted  the 
principals  from  the  registry  directly  using  the  rgy_edit  command.  The 
passwd_import  command  was  also  used  directly  to  add  the  1000  users  back  to  the 
registry.  Using  this  technique,  it  took  approximately  4  minutes  to  add  the  1000  users 
and  6  minutes  to  delete  them.  The  6  minutes  taken  to  delete  the  principals  contrasts 
sharply  with  the  1  hour  required  by  the  Security  Manger.  This  is  thought  to  be  due  to 
the  fact  that  the  Security  Manager  was  updating  the  display  for  every 
addition  /  deletion. 

4.3.3  Configuration  Manager 

The  Configuration  Manager  is  able  to  report  on  the  state  of  the  hosts  in  the  DCE  cell 
correctly.  This  information  includes: 

•  How  long  the  host  has  been  up 

•  Which  DCE  daemons  are  running 

•  The  state  of  DTS(time)  on  each  host 

The  Configuration  Manager  can  be  setup  to  poll  the  agent  software  at  regular  intervals 
and  update  the  status  display.  This  information  can  also  be  logged  to  file.  However, 
there  is  no  time  stamping  in  the  log  files  which  is  a  serious  oversight.  There  is  no 
capability  to  measure  load  or  response  time  of  either  DCE  servers  or  Application 
servers.  There  is  no  capability  to  graph  status  or  performance  over  time.  Despite 
these  shortfalls,  the  product  is  quite  useful  to  troubleshoot  a  DCE  cell  without  having 
to  visit  or  log  into  each  host  in  the  cell. 

In  one  case,  while  the  Configuration  Manager  was  left  in  a  monitoring  state,  one  of  the 
computers  in  the  cell  was  re-booted  by  its  user.  The  particular  machine  was  not  setup 
to  automatically  re-start  the  DCE  software.  This  change  of  state  was  detected  by  the 
Configuration  manager  and  represented  on  the  display  by  changing  the  colour  of  the 
icon  representing  that  host. 

In  addition,  hosts  can  be  configured  remotely,  from  the  Configuration  Manager.  The 
only  configuration  function  that  was  tested  was  the  ability  to  synchronise  DTS  on  all 
the  hosts.  This  feature  worked  as  expected  and  was  able  to  synchronise  the  hosts  in 
the  cell  to  within  less  than  a  second. 
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5.  Conclusions 


The  HaL  Cell  Manager  has  been  evaluated  and  found  to  be  a  useful  tool  for  easing  the 
burden  of  DCE  cell  administration.  Several  problems  and  potential  problems  with  the 
Cell  Manager  have  been  identified,  including: 

•  Lack  of  integration  of  the  user  interface  components. 

•  No  timestamps  in  log  files. 

•  No  capability  to  measure  and  graph  status  or  performance  against  time. 

Some  potential  problems  are: 

•  Consistency  of  the  Cell  Manager  and  associated  agent  software  with  updates  to 
DCE  and  related  utilities  on  many  platforms. 

•  Lack  of  scalability,  as  seen  by  the  length  of  time  taken  to  load  the  Namespace  and 
Security  Managers,  and  delete  1000  principals. 


Although  DCE  cell  management  and  Distributed  Systems  Management  in  general  are 
still  immature  technologies,  the  Cell  Manager  represents  a  major  step  in  the  right 
direction.  It  is  expected  that  other  DCE  system  management  or  system  administration 
tools  will  be  evaluated  in  the  future,  and  compared  to  the  Cell  Manager. 
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